Staff and permissions

Owner and staff

Every panel has one owner account: the address you gave when you ordered. The owner always exists and has every permission. The owner is changed in the panel settings, not on the Staff page.

Staff accounts are everyone else. Each has a name, an e-mail address, a username and a list of permissions. You can add, change, suspend and remove them while the panel is active. A panel can have at most 25 staff accounts.

A change you make is sent to the panel and usually takes about a minute to apply. The page tells you while it is still being applied.

Invite a staff member

• Open your panel in your account and choose Staff, then Add staff member.
• Enter the name, the e-mail address and the username (letters, digits, dot, dash and underscore). The e-mail address and the username cannot be changed later. To fix a mistake, remove the account and add it again.
• Choose the permissions, as described below.
• Press Add and send invite. The person gets an e-mail with a link to choose a password on your panel.

The invite link works once and lives for 14 days. If it expires or gets lost, use Resend invite on the person's page; the old link stops working. You can resend up to 5 times a day. For a person who already has a password but forgot it, use Send password reset link: the link works once for 24 hours and the current password keeps working until a new one is chosen.

Each person also has a sign-in check: the second step after the password, either an e-mail code or an authenticator app. It is asked every time that person signs in. You choose it on the person's page.

Choose permissions

Permissions are grouped by area of the panel: orders, users, subscriptions, drip-feed, tasks, services, payments, tickets, reports, child panels, appearance, providers, marketing, settings, general, network and the panel subscription. Each permission is a single action, such as viewing orders, changing an order status, replying to tickets or editing prices. A search box helps you find one.

Nothing is allowed by default: a staff member can do only what you ticked. A permission that needs another one to be useful brings it along, and it is added for you. For example, changing an order status needs viewing orders.

Three kinds of permission are marked on the page:

• Normal. Everyday work.
• Sensitive. Money, prices, balances, providers, exports and customer data.
• Takeover. Permissions that can take over the panel or a customer account, or change what secures it: security switches, code that runs on the customer site, payment methods, and the captcha and panel behaviour settings.

There is also All permissions. It includes everything, also permissions added later, and equals the owner apart from changing the owner. Use it for people you trust as you trust yourself, and rarely.

Presets and copying

You do not have to tick permissions one by one. Start from a preset, or copy the permissions of another staff member, then adjust. A copy is only a starting point: review it before you save.

• Manager. Every permission except the takeover ones.
• Support. Customers, orders, refills and tickets, with read access to services, payments and subscriptions. No prices or money changes.
• Orders operator. Orders, subscriptions, drip-feeds and tasks, with read access to services and providers, and the order report.
• Finance. Payments, balances, payment review, viewing vouchers, refunds of orders, and the payment and order reports.
• Read-only. Looking at orders, users, subscriptions, drip-feeds, tasks, services, payments, tickets, child panels and providers, with the order and ticket reports. Nothing can be changed.

These are suggestions, and the exact lists are shown on the page when you pick one.

Powerful permissions need your password

When you grant a sensitive or takeover permission, or All permissions, Arty first asks for your password and your second factor. This also applies when you add a new member with such a permission, when you re-enable a suspended member, and when you edit a member and add one. Taking permissions away needs no extra check.

Takeover permissions and All permissions have one more safeguard. The panel holds the grant for 24 hours before it starts. During that time the Staff page lists it under Waiting to start, with the time it starts. If you did not mean it, or someone else asked for it, use Cancel the waiting change before then and it never happens.

The owner e-mail of the panel is protected in the same spirit. Changing it needs confirmation from both the old and the new address, and it also waits before it takes effect.

Suspend, resume and remove

• Suspend stops the person from signing in to the panel, and any open session ends. Their account and permissions stay, so you can use it again later. Use it when someone is away or you are not sure.
• Resume re-enables a suspended account. If it holds a sensitive or takeover permission, Arty asks for your password again.
• Remove takes away access for good. The account stays as a record in the activity log. You can add the same e-mail address again later; it comes back as a new invite.

Each of these asks you to confirm. Staff accounts are shown with a status: invited, active, suspended or removed.

Good habits

• Give one person one account. Do not share sign-ins, so the activity log shows who did what.
• Start small. Pick the preset closest to the job and add permissions only when they are missing.
• Keep All permissions and takeover permissions for as few people as possible.
• Remove or suspend accounts the day someone leaves your team.

Staff members are an Arty feature of your panel, separate from the customers of your panel. To point your domain at the panel first, see connect your domain; to order a panel, see rent your first panel.